be-finfin-2026[.]com

This domain, be-finfin-2026.com, is actively engaged in credential harvesting phishing operations targeting financial and cryptocurrency users. Analysis indicates the site mimics legitimate financial platforms to deceive victims into submitting login credentials, payment details, or authentication tokens. The infrastructure is designed to exfiltrate sensitive data to attacker-controlled servers, likely for immediate exploitation in fraud or account takeovers. Given the domain's focus on financial services, the primary targets include users of banking portals, digital wallets, and decentralized finance platforms. Evidence supporting this assessment includes detection by 4 out of 95 security vendors on VirusTotal, with the domain appearing on three independent security blocklists. Registered through OwnRegistrar, Inc. on June 15, 2026, the domain resolves to 37.77.150.237, hosted on a Russian autonomous system (AS198953 Proton66 OOO). The SSL certificate, issued by Let's Encrypt (YR2), provides minimal encryption but does not validate legitimacy. The creation date, combined with the rapid inclusion on blocklists, suggests a deliberate and short-lived phishing campaign with high operational tempo. Users who have visited be-finfin-2026.com should assume their credentials or financial details were compromised. Immediate actions include revoking active sessions on any associated accounts, enabling multi-factor authentication where available, and monitoring for unauthorized transactions. If payment details were entered, contact financial institutions to issue new cards or freeze accounts. Clear browser cache and cookies to remove any residual tracking mechanisms. Network administrators should block the domain and its resolving IP at the perimeter to prevent further access. Given the domain's high-risk status and active status, continuous monitoring for related infrastructure is recommended.